CVE-2026-31657

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> batman-adv: hold claim backbone gateways by reference<br /> <br /> batadv_bla_add_claim() can replace claim-&gt;backbone_gw and drop the old<br /> gateway&amp;#39;s last reference while readers still follow the pointer.<br /> <br /> The netlink claim dump path dereferences claim-&gt;backbone_gw-&gt;orig and<br /> takes claim-&gt;backbone_gw-&gt;crc_lock without pinning the underlying<br /> backbone gateway. batadv_bla_check_claim() still has the same naked<br /> pointer access pattern.<br /> <br /> Reuse batadv_bla_claim_get_backbone_gw() in both readers so they operate<br /> on a stable gateway reference until the read-side work is complete.<br /> This keeps the dump and claim-check paths aligned with the lifetime<br /> rules introduced for the other BLA claim readers.